chore(security): land OpenSSF Scorecard hardening recipe (RAN-51)

[aksOps]

Summary

Recipe-validation lane for RAN-51 (parent: RAN-50) — lands the per-project supply-chain hardening kit on docsiq before it fans out mechanically to otelcontext, snipIT, and vigil. Mirrors the codeiq RAN-46 recipe.

• .github/workflows/security.yml (new) — OSS-CLI stack (Semgrep + osv-scanner + Trivy + Gitleaks + jscpd + anchore/sbom-action), language-adapted for Go + React/TS, all actions SHA-pinned, top-level permissions: read-all.
• .github/workflows/scorecard.yml — realigned to the codeiq RAN-46 recipe: push: [main] + weekly cron + workflow_dispatch, step-security/harden-runner audit egress, SARIF → Security tab, all actions SHA-pinned. (Previous bespoke workflow_run/branch_protection_rule triggers dropped so the four pending repos can take this file verbatim.)
• SECURITY.md — adds a "Hardening references" section linking scorecard.yml, security.yml, codeql.yml, dependabot.yml, and .bestpractices.json (project 12628, badge: passing).
• CLAUDE.md — adds a "Security & Supply-Chain" section documenting the Scorecard baseline + target (Best Practices passing is the hard gate; Scorecard observational with stretch ≥ 8.0/10 per the RAN-50 board ruling).
• .bestpractices.json — adds the OpenSSF schema header (project_id: 12628, level: passing, evidence map, audit metadata) on top of the existing per-criterion answers.

Out-of-band repo settings (already applied via gh api)

These satisfy the AC but live outside the diff:

• Branch protection on main → required_signatures.enabled = true (was false).
• Repo Dependabot security updates → enabled (was disabled).
• Paperclip Project Docs IQ → codebase.repoUrl = https://github.com/RandomCodeSpace/docsiq.git, defaultRef = main (was both null).

Per-language deltas vs codeiq RAN-46

Tool	docsiq adaptation
osv-scanner	--lockfile=go.mod + --lockfile=ui/package-lock.json (codeiq is npm-only because pomxml plugin hits deps.dev).
semgrep	p/security-audit + p/owasp-top-ten + p/golang + p/typescript (drops p/java).
jscpd	targets cmd internal ui/src, --format go,javascript,typescript, ignores *_test.go, e2e/, vendor/.
trivy / gitleaks / sbom	unchanged.

Will fold these per-language deltas back into shared/runbooks/engineering-standards.md after the four-repo fan-out so the runbook captures the validated matrix.

Test plan

• CI green: ci.yml, codeql.yml, the new security.yml jobs (osv-scanner, trivy, semgrep, gitleaks, jscpd, sbom).
• scorecard.yml triggers on this PR's main push and uploads SARIF to the Security tab.
• OpenSSF Best Practices badge in README.md continues to render passing against project 12628.
• Branch protection on main enforces signed commits — verified before opening this PR (gh api .../required_signatures → enabled: true).

🤖 Generated with Claude Code